File name:

mal2.exe

Full analysis: https://app.any.run/tasks/499285a5-9c63-4e85-9d2f-3c179b3473ce
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: May 12, 2025, 18:20:24
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
lumma
stealer
auto
generic
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

40F05840B47C583D938EAF3561D8FC2C

SHA1:

E49584659A22DCBFE77339BA7EFAE69FD405984B

SHA256:

36B74C379E4CBFF114A9EB4E60E5E729C793C5E9A7624808D1B428476E2DEBA9

SSDEEP:

98304:/EqmPkO4dC50hs7VR4mKIpWlaDGwzFG8tN5/wNyMjrtVcEDkHi2MSR0fSSWFZKRu:86dWTTdWTs

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • LUMMA mutex has been found

      • mal2.exe (PID: 7428)

    • Executing a file with an untrusted certificate

      • mal2.exe (PID: 7428)
      • TransactorSmart.exe (PID: 7792)
      • TransactorSmart.exe (PID: 7816)
      • TransactorSmart.exe (PID: 8068)

    • Steals credentials from Web Browsers

      • mal2.exe (PID: 7428)

    • Actions looks like stealing of personal data

      • mal2.exe (PID: 7428)
      • Etni.com (PID: 8120)

    • GENERIC has been found (auto)

      • mal2.exe (PID: 7428)
      • TransactorSmart.exe (PID: 7792)

    • Known privilege escalation attack

      • dllhost.exe (PID: 8020)

  • SUSPICIOUS

    • There is functionality for taking screenshot (YARA)

      • mal2.exe (PID: 7428)
      • Etni.com (PID: 8120)

    • The process drops C-runtime libraries

      • mal2.exe (PID: 7428)
      • TransactorSmart.exe (PID: 7792)

    • Executable content was dropped or overwritten

      • mal2.exe (PID: 7428)
      • TransactorSmart.exe (PID: 7792)
      • TransactorSmart.exe (PID: 7816)
      • TransactorSmart.exe (PID: 8068)
      • Etni.com (PID: 8120)
      • MicrosoftEdgeWebview2Setup.exe (PID: 1760)

    • Process drops legitimate windows executable

      • mal2.exe (PID: 7428)
      • TransactorSmart.exe (PID: 7792)
      • Etni.com (PID: 8120)
      • MicrosoftEdgeWebview2Setup.exe (PID: 1760)
      • MicrosoftEdgeUpdate.exe (PID: 6404)

    • Searches for installed software

      • mal2.exe (PID: 7428)

    • Starts itself from another location

      • TransactorSmart.exe (PID: 7792)

    • Starts application with an unusual extension

      • TransactorSmart.exe (PID: 8068)

    • Reads security settings of Internet Explorer

      • Etni.com (PID: 8120)
      • MicrosoftEdgeUpdate.exe (PID: 6404)

    • Connects to unusual port

      • Etni.com (PID: 8120)

    • Starts POWERSHELL.EXE for commands execution

      • Etni.com (PID: 8120)

    • Starts process via Powershell

      • powershell.exe (PID: 1276)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeUpdate.exe (PID: 6404)

    • Disables SEHOP

      • MicrosoftEdgeUpdate.exe (PID: 6404)

  • INFO

    • Reads the software policy settings

      • mal2.exe (PID: 7428)
      • Etni.com (PID: 8120)
      • MicrosoftEdgeUpdate.exe (PID: 6404)
      • wermgr.exe (PID: 6584)
      • slui.exe (PID: 7920)

    • The sample compiled with english language support

      • mal2.exe (PID: 7428)
      • TransactorSmart.exe (PID: 7792)
      • TransactorSmart.exe (PID: 7816)
      • Etni.com (PID: 8120)
      • MicrosoftEdgeWebview2Setup.exe (PID: 1760)
      • MicrosoftEdgeUpdate.exe (PID: 6404)

    • Checks supported languages

      • mal2.exe (PID: 7428)
      • TransactorSmart.exe (PID: 7792)
      • TransactorSmart.exe (PID: 7816)
      • TransactorSmart.exe (PID: 8068)
      • Etni.com (PID: 8120)
      • tcpvcon.exe (PID: 7840)
      • MicrosoftEdgeWebview2Setup.exe (PID: 1760)
      • MicrosoftEdgeUpdate.exe (PID: 6404)
      • tcpvcon.exe (PID: 8144)

    • Reads the computer name

      • mal2.exe (PID: 7428)
      • TransactorSmart.exe (PID: 7792)
      • TransactorSmart.exe (PID: 7816)
      • tcpvcon.exe (PID: 7840)
      • Etni.com (PID: 8120)
      • tcpvcon.exe (PID: 8144)
      • MicrosoftEdgeUpdate.exe (PID: 6404)
      • TransactorSmart.exe (PID: 8068)

    • Creates files or folders in the user directory

      • TransactorSmart.exe (PID: 7792)
      • Etni.com (PID: 8120)
      • wermgr.exe (PID: 6584)

    • Creates files in the program directory

      • TransactorSmart.exe (PID: 7792)
      • TransactorSmart.exe (PID: 7816)
      • Etni.com (PID: 8120)
      • MicrosoftEdgeWebview2Setup.exe (PID: 1760)

    • Create files in a temporary directory

      • mal2.exe (PID: 7428)
      • TransactorSmart.exe (PID: 7816)
      • TransactorSmart.exe (PID: 8068)

    • Reads the machine GUID from the registry

      • tcpvcon.exe (PID: 7840)
      • Etni.com (PID: 8120)

    • Reads security settings of Internet Explorer

      • dllhost.exe (PID: 8020)

    • Reads Environment values

      • MicrosoftEdgeUpdate.exe (PID: 6404)

    • Checks proxy server information

      • MicrosoftEdgeUpdate.exe (PID: 6404)
      • wermgr.exe (PID: 6584)
      • slui.exe (PID: 7920)
      • Etni.com (PID: 8120)

    • Process checks computer location settings

      • MicrosoftEdgeUpdate.exe (PID: 6404)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (50.1)
.exe | Win64 Executable (generic) (32.2)
.dll | Win32 Dynamic Link Library (generic) (7.6)
.exe | Win32 Executable (generic) (5.2)
.exe | Generic Win/DOS Executable (2.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:04:03 20:18:50+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 24576
InitializedDataSize: 141824
UninitializedDataSize: 2048
EntryPoint: 0x326a
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 131.0.6778.109
ProductVersionNumber: 131.0.6778.109
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: ASCII
CompanyName: Comodo
FileDescription: Comodo Dragon
FileVersion: 131.0.6778.109
LegalCopyright: Copyright (c) 2009-2024, Comodo Security Solutions, Inc.
ProductName: Comodo Dragon
ProductVersion: 131.0.6778.109
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
17
Malicious processes
8
Suspicious processes
1

Behavior graph

Click at the process to see the details
start #LUMMA mal2.exe #GENERIC transactorsmart.exe svchost.exe transactorsmart.exe tcpvcon.exe no specs conhost.exe no specs slui.exe CMSTPLUA transactorsmart.exe etni.com tcpvcon.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs microsoftedgewebview2setup.exe microsoftedgeupdate.exe wermgr.exe

Process information

PID
CMD
Path
Indicators
Parent process
1276powershell.exe -Command "Start-Process 'C:\ProgramData\MicrosoftEdgeWebview2Setup.exe' -ArgumentList '/silent','/install' -Wait"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—Etni.com
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1760"C:\ProgramData\MicrosoftEdgeWebview2Setup.exe" /silent /install C:\ProgramData\MicrosoftEdgeWebview2Setup.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update Setup
Exit code:
2147747592
Version:
1.3.195.25
Modules
Images
c:\programdata\microsoftedgewebview2setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
4880\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—tcpvcon.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6404"C:\Program Files (x86)\Microsoft\Temp\EU6F0E.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"C:\Program Files (x86)\Microsoft\Temp\EU6F0E.tmp\MicrosoftEdgeUpdate.exe
MicrosoftEdgeWebview2Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update
Exit code:
2147747592
Version:
1.3.195.25
Modules
Images
c:\program files (x86)\microsoft\temp\eu6f0e.tmp\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ole32.dll
c:\windows\syswow64\ucrtbase.dll
6584"C:\WINDOWS\system32\wermgr.exe" "-outproc" "0" "6404" "1988" "1776" "2012" "0" "0" "0" "0" "0" "0" "0" "0" C:\Windows\SysWOW64\wermgr.exe
MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wermgr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
6668\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7428"C:\Users\admin\AppData\Local\Temp\mal2.exe" C:\Users\admin\AppData\Local\Temp\mal2.exe
explorer.exe
User:
admin
Company:
Comodo
Integrity Level:
MEDIUM
Description:
Comodo Dragon
Exit code:
0
Version:
131.0.6778.109
Modules
Images
c:\users\admin\appdata\local\temp\mal2.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7792"C:\Users\admin\AppData\Local\Temp\6IC4IK2P693D2TS2KRCMF\TransactorSmart.exe"C:\Users\admin\AppData\Local\Temp\6IC4IK2P693D2TS2KRCMF\TransactorSmart.exe
mal2.exe
User:
admin
Company:
DivX, LLC
Integrity Level:
MEDIUM
Description:
DivX Download Manager Service
Exit code:
0
Version:
1.2.0.195
Modules
Images
c:\users\admin\appdata\local\temp\6ic4ik2p693d2ts2krcmf\transactorsmart.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
7816C:\ProgramData\asus\TransactorSmart.exeC:\ProgramData\asus\TransactorSmart.exe
TransactorSmart.exe
User:
admin
Company:
DivX, LLC
Integrity Level:
MEDIUM
Description:
DivX Download Manager Service
Exit code:
0
Version:
1.2.0.195
Modules
Images
c:\programdata\asus\transactorsmart.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
Total events
10 544
Read events
10 506
Write events
36
Delete events
2

Modification events

(PID) Process:(8020) dllhost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(8120) Etni.comKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(8120) Etni.comKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(8120) Etni.comKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6404) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe
Operation:writeName:DisableExceptionChainValidation
Value:
0
(PID) Process:(6404) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\proxy
Operation:writeName:source
Value:
auto
(PID) Process:(6404) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\PersistedPings\{63435B31-F898-485D-A7C8-816095FCCD3C}
Operation:delete keyName:(default)
Value:
(PID) Process:(6404) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\PersistedPings\{63435B31-F898-485D-A7C8-816095FCCD3C}
Operation:writeName:PersistedPingString
Value:
<?xml version="1.0" encoding="UTF-8"?><request protocol="3.0" updater="Omaha" updaterversion="1.3.195.25" shell_version="1.3.147.37" ismachine="1" sessionid="{0087B0A4-183D-4790-AF50-23A059AF58AF}" userid="{FD984739-A122-4DB0-BE5B-46E3E09D84E4}" installsource="otherinstallcmd" requestid="{63435B31-F898-485D-A7C8-816095FCCD3C}" dedup="cr" domainjoined="0"><hw logical_cpus="4" physmemory="4" disk_type="2" sse="1" sse2="1" sse3="1" ssse3="1" sse41="1" sse42="1" avx="1"/><os platform="win" version="10.0.19045.4046" sp="" arch="x64" product_type="48" is_wip="0" is_in_lockdown_mode="0"/><oem product_manufacturer="DELL" product_name="DELL"/><exp etag="&quot;r452t1+k2Tgq/HXzjvFNBRhopBWR9sbjXxqeUDH9uX0=&quot;"/><app appid="{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" version="1.3.185.17" nextversion="1.3.195.25" lang="" brand="" client=""><event eventtype="2" eventresult="1" errorcode="0" extracode1="0" system_uptime_ticks="10783979536" install_time_ms="531"/></app></request>
(PID) Process:(6404) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\PersistedPings\{63435B31-F898-485D-A7C8-816095FCCD3C}
Operation:writeName:PersistedPingTime
Value:
133915477547042630
(PID) Process:(6404) MicrosoftEdgeUpdate.exeKey:\REGISTRY\A\{144a5b9a-19e0-0fdc-66ab-86a81a10b36d}\Root\InventoryApplicationFile
Operation:writeName:WritePermissionsCheck
Value:
1
Executable files
211
Suspicious files
21
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
7428mal2.exeC:\Users\admin\AppData\Local\Temp\6IC4IK2P693D2TS2KRCMF\aurelian.torrentbinary
MD5:73051F1FED9D7F0B21D4CDC48224A32B
SHA256:C050D48792242351FD33A0375F262B8743EB61164D250D27758286C9083FE3FD
7428mal2.exeC:\Users\admin\AppData\Local\Temp\6IC4IK2P693D2TS2KRCMF\DivXDownloadManager.dllexecutable
MD5:E1146619FC1DB71A1E3668371342E626
SHA256:A39E5A8204F10AD32C0156569439624D744A4D504CBEF9925E94BCC7439FEC0E
8120Etni.comC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_3AD253ACA02D44EA5FD30683B8A5B5FAbinary
MD5:DCF3E55BA89D9E43118CC81B079C5FFD
SHA256:5EA1B1CDD7A3CEF26248802AF70F45B0DAEFEE36CC9DE921AE99D570CEB8BAB5
7792TransactorSmart.exeC:\ProgramData\asus\DivXDownloadManager.dllexecutable
MD5:E1146619FC1DB71A1E3668371342E626
SHA256:A39E5A8204F10AD32C0156569439624D744A4D504CBEF9925E94BCC7439FEC0E
8068TransactorSmart.exeC:\Users\admin\AppData\Local\Temp\FA1D2AF.tmp —
MD5:—
SHA256:—
7428mal2.exeC:\Users\admin\AppData\Local\Temp\6IC4IK2P693D2TS2KRCMF\TransactorSmart.exeexecutable
MD5:FF254C1778AEFE5AF06889F1F999DEE3
SHA256:94BC0C01641801F258E207ECA8227845F3F1C686E7394CE3864A6B2538B8EADB
7816TransactorSmart.exeC:\ProgramData\asus\tcpvcon.exeexecutable
MD5:1CF39530D557CE880D7F71984928384F
SHA256:198995FECC0E38A2749B7E48C54112A959B77878683B726EE36430C4BACEC196
7792TransactorSmart.exeC:\ProgramData\asus\msvcr80.dllexecutable
MD5:43143ABB001D4211FAB627C136124A44
SHA256:CB8928FF2FAF2921B1EDDC267DCE1BB64E6FEE4D15B68CD32588E0F3BE116B03
7428mal2.exeC:\Users\admin\AppData\Local\Temp\6IC4IK2P693D2TS2KRCMF\msvcr80.dllexecutable
MD5:43143ABB001D4211FAB627C136124A44
SHA256:CB8928FF2FAF2921B1EDDC267DCE1BB64E6FEE4D15B68CD32588E0F3BE116B03
7792TransactorSmart.exeC:\ProgramData\asus\aurelian.torrentbinary
MD5:73051F1FED9D7F0B21D4CDC48224A32B
SHA256:C050D48792242351FD33A0375F262B8743EB61164D250D27758286C9083FE3FD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
37
DNS requests
27
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.147:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
8120
Etni.com
GET
200
18.245.38.41:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D
unknown
—
—
whitelisted
7612
SIHClient.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6584
wermgr.exe
GET
200
23.48.23.140:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7612
SIHClient.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
8120
Etni.com
GET
200
143.204.99.128:80
http://ocsp.r2m04.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEAqlOECbKpghQnC3N5zkTKU%3D
unknown
—
—
unknown
6584
wermgr.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.48.23.147:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
69.192.161.161:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6544
svchost.exe
20.190.160.65:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
—
—
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
7612
SIHClient.exe
172.202.163.200:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.48.23.147
  • 23.48.23.194
  • 23.48.23.177
  • 23.48.23.145
  • 23.48.23.164
  • 23.48.23.143
  • 23.48.23.141
  • 23.48.23.176
  • 23.48.23.180
  • 23.48.23.140
  • 23.48.23.190
  • 23.48.23.139
  • 23.48.23.191
  • 23.48.23.138
  • 23.48.23.193
whitelisted
www.microsoft.com
  • 69.192.161.161
whitelisted
google.com
  • 142.250.185.206
whitelisted
login.live.com
  • 20.190.160.65
  • 40.126.32.136
  • 40.126.32.134
  • 20.190.160.20
  • 40.126.32.140
  • 20.190.160.3
  • 20.190.160.130
  • 20.190.160.4
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
throwiurqe.run
  • 172.67.204.143
  • 104.21.22.114
unknown
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Suspected Domain Associated with Malware Distribution (postedtipped .top)
2196
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
2196
svchost.exe
Misc activity
ET TA_ABUSED_SERVICES DNS Query to Commonly Actor Abused Online Service (data-seed-prebsc-1-s1 .binance .org)
8120
Etni.com
Misc activity
ET TA_ABUSED_SERVICES Observed Commonly Actor Abused Online Service Domain (data-seed-prebsc-1-s1 .binance .org in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
mal2.exe